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Abstract The design and simulation of an on-line algorithm which estimates the 
safe maneuvering envelope of aircraft is discussed in this paper. The trim enve- 
lope is estimated using probabilistic methods and efficient high-fidelity model based 
computations of attainable equilibrium sets. From this trim envelope, a robust reach- 
ability analysis provides the maneuverability limitations of the aircraft through an 
optimal control formulation. Both envelope limits are presented to the flight crew on 
the primary flight display. In the results section, scenarios are considered where this 
adaptive algorithm is capable of computing online changes to the maneuvering en- 
velope due to impairment. Furthermore, corresponding updates to display features 
on the primary flight display are provided to potentially inform the flight crew of 
safety critical envelope alterations caused by the impairment. 


1 Introduction 


In all transportation systems, but especially in civil aviation, safety is of paramount 
importance. Many developments focus on improving safety levels and reducing the 
risks of life threatening failures. In a recent study by the Commercial Aviation 
Safety Team (CAST) and the International Civil Aviation Organization (ICAO), it 
can be observed that loss of control in flight (LOC-I) is the most frequent primary 
accident cause. This study is based on a statistical analysis of aircraft accidents be- 
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tween 2002 and 2011, and indicates that this category accounts for as much as 23% 
of all fatal aircraft accidents and involves most fatalities[l], LOC-I can have various 
causes, occurring individually or in combination, such as a system malfunction, at- 
mospheric disturbances (e.g. turbulence or icing), and loss of situational awareness 
by the crew. An important aspect during operations under system malfunction or 
atmospheric disturbance is that the crew needs to maintain awareness through pos- 
sibly time changing degradation of aircraft performance characteristics. The CAST 
established a specialized international safety analysis team to study the apparent 
growing trend in loss of Airplane State Awareness (ASA) by the flight crew. This 
team has produced recommended safety enhancements that include research to de- 
velop and implement technologies for enhancing flight crew awareness of airplane 
energy state (SE 207)[2]. The approach developed in this paper focuses on increas- 
ing awareness of the boundaries of the safe flight envelope over which the pilot can 
maneuver without losing control over the plane. These boundaries can be updated 
based on possibly time changing flow of information regarding the aircraft state. 

A variety of methods conforming to this concept have been investigated in pre- 
vious studies. The most straightforward methods include wind tunnel testing, flight 
test experiments and high-fidelity model-based computation of attainable equilib- 
rium sets or achievable trim points [23], possibly with bifurcation analysis [7] or a 
vortex lattice algorithm combined with an extended Kalman filter[16]. More com- 
plex methods include formulating flight envelope estimation as a reachability prob- 
lem and solving this with level set methods and Hamilton- Jacobi equations [15], 
possibly with time scale separation [5] or semi-Lagrangian level sets [19], Alterna- 
tive methods rely on linearization and region of attraction analysis [20], determining 
controllability/maneuverability limits in a quaternion-based control architecture[3] 
or robustness analysis for determination of reliable flight regimes [22]. An approach 
suggested by Boeing uses Control-Centric Modeling, dynamic flexible structure and 
load models [24]. In the frequency domain, stability margins can be estimated in real 
time via nonparametric system identification [8], More focused techniques inspired 
by flight dynamics exist as well, such as determining the minimum lateral control 
speed[6]. In this approach, the trim envelope is estimated through efficient high- 
fidelity model-based computations of attainable equilibrium sets based on aero- 
dynamic coefficient identification from air data, inertial and GPS measurements. 
The corresponding maneuverability limitations of the aircraft are then determined 
through a robust reachability analysis (relative to the trim envelope) through an op- 
timal control formulation and based on the principle of time scale separation. The 
theoretical underpinnings covering the overall approach are available in previous 
publications[12, 21]. 

The structure of this paper is as follows. In Sec. 2, the estimation of the envelope 
boundaries is discussed. The method for presenting this information to the crew is 
elaborated in Sec. 3. Sec. 4 discusses some relevant application example scenarios. 
Conclusions and recommendations can be found in Sec. 5. Further related research 
based on the results presented here is described in Sec. 6. 
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2 Estimation of the envelope boundaries 

The safe maneuvering envelope is a fundamental property of the aircraft’s design 
and overall current state of health. By definition it determines the overall capability 
of the aircraft. If actively monitored in time, it may function as an early warning sys- 
tem as well as provide anticipatory guidance to help avoid loss of control. For exam- 
ple, automated planning tools may use it to help pilots land safely under emergency 
landing conditions! 17], or when combined with a display it may result in overall bet- 
ter pilot awareness of the state of the aircraft. This can be particularly useful when 
an automation system switches off. Additionally, the physics-based maneuverabil- 
ity envelope can be analyzed separately from the control strategy, and knowledge 
of the envelope may for example unmask control limitations clouded by adaptive 
controllers, and even lower barriers to the introduction of more advanced uncon- 
ventional control strategies [9]. For these reasons, improved methods for tracking 
aircraft maneuverability in real-time may effectively help pilots avoid inappropriate 
crew response and further prevent or recover aircraft from upset conditions. Gen- 
erally, the maneuvering envelope is the set of safe aircraft state and control inputs. 
Unfortunately, because of the underlying nonlinear aircraft dynamics, it is challeng- 
ing to calculate this set of states accurately and rapidly enough to provide the pilot 
or automation system with reliable information in a diverse and rapidly changing 
environment. 


2.1 Mathematical model postulation and parameter identification 

The aircraft model used for this simulator study is the nonlinear RCAM (Research 
Civil Aircraft Model) simulation model, which is representative of a large two- 
engine jet transport with general characteristics of a wide-body, conventional tail 
and low wing airplane configuration with twin turbofan engines located under the 
wings[14]. The physical dimensions are similar to an Airbus A300 aircraft, with 
flight characteristics representative of a large jet transport in landing configuration 
(flaps at 32.5 deg and gear down) at sea level. A selection of RCAM model data is 
provided in Table 1 . 


Table 1 Selection of parameter values for RCAM model 


Constants 

Aerodynamic Coefficients 

Input Bounds 

S = 260 m 2 
m = 120 x 10 3 kg 
g = 9.81 m/s 2 
p = 1.225 kg/m 3 

C Do = 0.1599 

C Da = 0.5035 C,„ 0 = -0.015 
C Dal = 2.1175 C ma = —2.15 
Cl„ = 1.0656 C mq = -14.0 
C La = 6.0723 C,„ 5 = -2.87 
Cy b = -1 

T e [20546,410920] N 
a 6 [0. 14.5] deg. 

8 e e [—30.0,20.0] deg. 
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Nonlinear aircraft dynamics with higher dimensions can be simplified by consid- 
ering the principle of time scale separation[5]. The structure of time scale separation 
is analogous as applied for the fault tolerant control algorithm developed earlier[9]. 
The overview can be found in Fig. 1, which illustrates that a nine dimensional non- 
linear problem is decoupled in three consecutive three dimensional optimization 
problems. 
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Fig. 1 Separation of dynamics over high bandwidth, middle range and low bandwidth 


2.1.1 Model postulation 

A nonlinear 3D aircraft example is considered. Main focus of this research is on the 
slow aircraft dynamics as specified in Fig. 1, involving the aerodynamic forces lift L, 
drag D and sideforce T a ero- Also the pitching moment M, as part of the fast dynamics, 
has been included in the model but this moment can be considered separately from 
the aerodynamic forces, thanks the the principle of time scale separation, see Fig. 
1. The acting forces on the aircraft are illustrated in Fig. 2 for a symmetric flight 
condition. 


Y >\Y« 



Fig. 2 Acting forces on the aircraft model, source: Lygeros[15] 


For the complete 3D situation, the equations of motion are written as follows [9]: 
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F Ax -Wsmy=mV (1) 

F Az cos (p + F Ay sin < p + W cos y = —mV y (2) 

Where the aerodynamic forces can be simplified assuming small aerodynamic an- 
gles a and /): 


F Ax = Tcos ft cos a — D (V, a) « T —D(V,a) (3) 

F Az = -Tsina-L(V,a)tt-L{V,a) (4) 

F Ay = -T sin/3 cos a + y aero (V, p) « T a ero (V, P ) (5) 

with the following expansions for lift L, drag D and sideforce F a eroi 

D(V, a) = qS (c Do + C Da a + C Dal a 2 ^j (6) 

L(V,a) = qS(C Lo +C La a ) (7) 

Y mo (V,P)=qs(c Yli p) ( 8 ) 

where the dynamic pressure q— 1 /2 pV 2 . 


The aircraft dynamics are combined in the following matrix structure: 



(£v 2 CD 0 -gsmy 

— y cos y 


T 

T 

— + 

~-^V 2 (c Da a + C Da2 a 2 ) 

0 

m 

- Wn V { C L a + C L a a)cOS(p _ 


0 

-£ S n VC YpP^(P 

(9) 


where thrust T and angle of attack a are treated as virtual inputs, based on the 
time scale separation principle as illustrated in Fig. 1. An affine matrix structure in 
the inputs is obtained by simplifying for small angles of attack a and sideslip p . 

The pitching moment structure typically varies for every aircraft type. For this 
specific model, a model structure selection analysis [10, 9] has provided the follow- 


ing structure: 


C m — CffiQ + Cm a M + Cr 


q -+c 

Iqc T/ ' L '»i 

V v 


Sq + C m . j'h -|- c, 


mj _ 


qdl 


eng 


( 10 ) 


2.1.2 Parameter identification 

In order to characterize the flight envelope of a particular aircraft, the as of yet unde- 
termined aerodynamic coefficients need to be reconstructed using available sensor 
measurements. This is a necessary step, that essentially fits the above described dy- 
namics model to any particular aircraft, or aircraft simulation of higher fidelity. An 
inertial sensor package, consisting of rate gyros and accelerometers, provides an- 
gular rates and accelerations as well as specific forces. It is assumed that a state 
estimation algorithm[13] is available, taking into account sensor disturbances (bi- 
ases and/or noise), and compensating for them. 
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The forces in the body fixed reference frame are reconstructed from: 


2ftot 

= mA x 

Dot 

= mAy 

Ztot — wiA z 

(ID 

X 

T-X tot 


Y 
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qS 

qS 

Cy 

qS 

Cz = Ts 

(12) 


where A x , A y and A z are the specific forces as measured by the accelerometers. 
The force coefficients in the body fixed reference frame are then transformed to the 
aerodynamic reference frame using 

( — C/A / cosa 0 sina\ / cos/3 sin/3 0\ (Cx\ 

Cr aero = 0 10- -sin/3 cos/3 0 • \C Y . (13) 

—Cl) sin a 0 cos a) \ 0 0 1 ) \CzJ 

Finally, the pitching moment coefficient is reconstructed from the corresponding 
moment equation 


M_ _ qlyy + pr (Jxx - Izz) + ( P 2 ~ r 2 ) Ixz 
qSc qSc 


where I xx , Iyy, I zz , and I xz are the components of the inertia matrix in the body axis, 
and where p, q , and r are respectively the roll, pitch, and yaw rate components of 
the body-axis angular velocity. 

The above defined flight dynamics model provides the means through which one 
can assess the flight performance capability of the aircraft. However, it depends 
on a set of effective aerodynamic coefficients, which should be estimated from the 
combination of available sensor data and the known physical relationships between 
quantities specified by the model. The aerodynamic coefficient vector to be identi- 
fied for the forces is defined as: 


c = 


Cdq > Cu a , Cd j j Cl 0 , Cl u 


and the moment coefficient vector is: 


m = 


1 T 


CniQ > Cm a > C m s , C m „ , C m . , C mj . 

V 


A specialized Bayesian probabilistic approach was developed to infer the un- 
known aerodynamic coefficients from the noisy sensor measurements and to quan- 
tify the estimation uncertainty; an overview of which is provided next. More infor- 
mation about the identification procedure, including results, can be found in Schuet 
et. al. [21], 

A state measurement process x(k) = [V (k),y(k)] is defined, which proceeds, for 
k = 1,2,... .in 1, according to a midpoint-Euler discrete approximation: 


x(£ T 1 ) = x(£) + /zf(x, u; c) + T (k), 


(15) 
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where f(x,u;c) represents the continuous flight dynamics model (9), u is the vector 
of known virtual inputs at time instance k, 

u(k) = [T,a,p] T , 

h is the time-sample resolution, x = [x(fc) + x(k + l)]/2 is the midpoint, and 
T (k) ~ jY (0. hS ') is the additive independent and identically distributed Gaus- 
sian measurement noise process. While the maneuverability model is linear in c, it 
is still nonlinear in x and u, and the midpoint-Euler approximation enables better 
representation of the true nonlinear system, for negligible additional computational 
cost. The inverse covariance matrix S is an important statistical parameter that char- 
acterizes the process noise x(k), which will also be estimated from the observed 
data. 

In similar fashion, one can also define processes for the accelerometer measure- 
ments 

x a (k) = A k c + T a (k), 

where A* is a matrix, depending on u(k), that implements the combination of (13) 
and (6)-(8). Finally, the moment measurement process is defined as 

•*m (k) = M^ni T T m (&), 

where M* is a row vector implementing (10), that depends on the moment model 
input variables. Also, T a and T m represent independent additive Gaussian measure- 
ment noise terms for the accelerometer and moment measurements, with associated 
inverse covariance matrix S a and scalar inverse variance .S’ m , respectively. Further- 
more, the moment measurement process is independent of the dynamics and ac- 
celerometer measurement processes, and can therefore be treated by a separate in- 
ference process, that follows the same approach used to infer the aerodynamic force 
coefficients summarized next. 

Focusing on the estimation of the force coefficient vector c, the above measure- 
ment model equations and Gaussian noise distribution assumptions enable one to 
specify the multivariate probability density function (pdf) for the measured data 
given the model parameters 


p(X,X a |c,S,S a ,U), (16) 

where X, X a , and U represent matrices containing the entire history of state, ac- 
celerometer, and input data measurements, respectively. Through Bayes’ Theorem, 
the likelihood pdf (16) can then be combined with appropriate prior information to 
determine the posterior pdf 


p(c,S,S a |X,X a ,U) (17) 

that specifies the probability density of the unknown parameter values c and inverse 
measurement noise covariance matrices, given all of the observed data and prior 
information. The optimal parameter estimate is then found by solving 
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maximize p(c,S,S a |X,X a ,U) (18) 

with respect to the unknown aerodynamics coefficients c and inverse covariance 
matrix terms S and S a . 

With the modeling and additive noise assumptions used in the derivation, the pos- 
terior pdf (17) is log-concave in any one of the variables c, S, or S a when the other 
two variables are held fixed. This enables the efficient computation of a local opti- 
mal estimate using a block coordinate descent method to break the solution process 
into steps that require solving simple convex optimization problems. Furthermore, 
the coefficient parameter estimation uncertainty and Bayesian model evidence can 
also be estimated using closed form expressions. See [21] for details. 


2.2 Estimation of the trim envelope 

One important feature of the maneuverability model (9) is that it enables a rapid 
numerical analysis of the trimmable states. To see how this works first note the 
definition of the set of trimmable states is 

{x|f(x,u;c) =0, (x,u) (19) 

where 88 represents the set of overall allowable states and virtual inputs. This set is 
important because it represents an a-priori safe maneuverability envelope. 

For the maneuverability model, and a given aerodynamic parameter vector c, 
characterizing the set of trimmable points then involves setting the top and bottom 
equations on the right hand side of (9) equal to zero. The bottom equation is solved 
for angle of attack a in terms of the other variables in that equation, which do not 
include thrust T. The top equation is then solved for T into which the previous solu- 
tion for a is substituted. The result is a closed form solution for the required thrust 
and alpha needed to achieve trim for any given trim state and other virtual inputs. 
This enables a fast numerical sweep to determine the non-convex trim envelope as 
follows: 

1. Setup a grid of state values in 88. For most practical applications a coarse reso- 
lution is sufficient. 

2. Fix values for roll angle (j) and side-slip angle j3, and make them equal to the 
current values. 

3. For each point in the state grid solve for the thrust T and angle of attack a needed 
to achieve trim. 

4. Return only those points for which T and a are within 88. 

A crude visualization of the (V, y)-trim envelope is then obtained by simply plot- 
ting the trimmable points from the above calculation. In addition, one should check 
whether the achieved trim points are stable. This involves checking the eigenvalues 
associated with the local linear approximation to (9) at each trim point, and as be- 
fore a closed form expression can be found. The entire computation is fast enough 
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on a modem PC to enable dynamic re-computation as aircraft conditions change, or 
to compute extended envelopes by sweeping over values for (f) and p . 

The actual maneuverability calculation for a grid covering 5029 points is com- 
pleted in 21 ms on a 2.6 GHz MacBook Pro. The calculation includes a check for 
stability [21], An example trim envelope is shown in Fig. 3, and is based on the 
RCAM simulation model. 



Fig. 3 Trim envelope for the RCAM model and required inputs for trim points 


In Fig. 3, it can be seen that the trim envelope boundaries are imposed by the 
input saturation limits. The upper boundary corresponds to maximum thmst 7 max = 
410920N, the lower boundary is imposed by minimum thrust T m [ n = 20546N. The 
range for the angle of attack results in the boundaries left (a max = 14.5°, prior to 
stall) and right (a m i n = 0°). It can also be observed that more thrust is needed for 
larger flight path angles, because the thrust force has to counteract the exponentially 
increasing drag force, since a larger angle of attack occurs for slower speeds. Ana- 
lyzing the range of thrust values over airspeed for constant flight path angle, shows 
that more thrust is needed for a further speed decrease below 69m/s. This region 
corresponds to the range of the angle of attack a > 4.5°. Analysis of the Lift-Drag 
Polar and the power required curve, shown in Fig. 4, confirms that this region is the 
back side of the power curve, and that V = 69m/s is the minimum drag airspeed. 


2.3 Estimation of the maneuvering envelope 

In this context, the preferred interpretation of the safe maneuvering envelope con- 
siders reachability from the trim envelope. The stable and controllable trim envelope 
is considered an a-priori safe set. The backwards reachable set is defined as the set 
of states from where (at least one point in) the trim envelope can be reached. The 
forwards reachable set is defined as the set of states which can be reached from (at 
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Fig. 4 Lift-Drag Polar and power required curve of the RCAM model confirm that minimum drag 
airspeed is V = 69m/ s, and the region to the left is the back side of the power curve 


least one point in) the trim envelope. Then the safe maneuvering flight envelope 
is the cross section between the forwards and backwards reachable sets. This in- 
terpretation is illustrated in Fig. 5. In addition to the safe envelope, the backwards 
reachable set is considered as the survivable flight envelope. After an upset due to 
damage, turbulence, a wake encounter etc., it is possible to bring the aircraft back 
to a safe trim condition as long as the current flight condition is situated inside the 
backwards reachable set. 



Fig. 5 Safe maneuvering envelope as intersection between forwards and backwards reachability, 
modified from source: van Oort[ 191 


The aim is to perform a combined forward and backward reachability analysis 
from the trim envelope as efficiently as possible, for on-line implementations. Based 
on previous research[4], level set methods are an excellent candidate. Finally, ro- 
bustness is an important aspect to be considered in this context as well. 

It has been shown in the literature that maneuvering envelope estimation through 
reachability can be reformulated in the optimal control framework[15]. Consider a 
continuous time control system: 
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X = f(x,U.4) (20) 

with x € R”, u £ U C R m , A £D C R A , f (•, •) : R" xU — » R", a function: 

/ (•) : R" — >• R (21) 

and an arbitrary time horizon T > 0. Let T/ , ,/ denote the set of Lebesgue and 
bounded measurable functions from the interval \t,t'} to U. Define <p (x.t.x.u {■),A)as 
the state trajectory. A are defined as parameter uncertainties. Given a set of states 
K C R", the reachability question can be naturally formulated regarding the rela- 
tion between the set K and the state trajectories <j> of Eq. (20) over the horizon T . 
Problem of interest is the following: 

Robust reachability: Does there exist au£f [o,r] and a t £ [0, T] such that the 
trajectory (/> of the state x satisfies x £ K, irrespective of A ? 

The optimization problem can be formulated as a pursuit evasion game over the 
horizon T > 0 with target set K C R" [5], It is assumed that u is trying to bring or 
keep the state in the set K, whereas A is trying to drive it out of K. To ensure the 
game is well-posed, u is restricted to play non-anticipative strategies with respect to 
the unknown uncertainties A . 

For the types of safety problems considered here, a set of initial states has to 
be established such that u can win the game, in other words the set Reach can be 
characterized as follows: 

Reach robust (t,K) = { x e R" | \/A e D, 3u G a ^\u] , 

3t€ [t,T],<l>(T,t,x,u(-),A) GK} 

As done elsewhere in the literature[15], the characterization of this set can be 
done according to the principle of duality: 

Reach(t,/f) = (Inv(t,/f c )) c (22) 

Through this principle, it can be characterized as an INFMIN problem[15]. The crux 
is to include the A’s as disturbances in the optimization function, they oppose the 
optimization over u. Consider a closed set K , that can be written as the level set of 
a continuous function l : R" — > R, i.e. K = {x £ R"| / (x) ^ 0}. As a consequence, 
the Invariance optimization formulation becomes [5]: 

Inv (t,K) = { x € R" | Vo (x, t) ^ 0} (23) 

with: 

V 2 (x,t) = inf sup min l (<f> (T,f,x,u(-) ,A)) (24) 

“(■)£%, r] AeD T<E [*T! 

This can be reformulated into an Hamilton-Jacobi-Bellmann Partial Differential 
Equation[15, 5]: 
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min < inf 

xe[t,T] lu(-)6%], 



= 0 (25) 


where V% (x,T) = l (x) holds for backward integration and V 2 (x,f) = l (x) applies 
to forward integration. These HJB PDE’s can be solved by level sets, for which a 
toolbox is available in Matlab®[18]. 

A more elaborate discussion of the optimization strategy, and the detailed ap- 
proach followed, is discussed by Lombaerts et al[12]. 


2.4 Maximum bank angle calculation 

The maximum bank angle (j) can be calculated as the bank angle at which the vertical 
component of the maximum attainable lift vector balances the weight vector of the 
aircraft. This means that banking the aircraft at the current airspeed beyond this 
maximum angle will result in a stall. This concept is illustrated in Fig. 6. 



t w 


Fig. 6 Force balance between lift and weight in a turn 


Equilibrium of forces in the vertical plane requires that: 


L cos ycos <j) =W 


(26) 


Rewriting for bank angle <j>: 

W W 


(27) 


Lcosy C L l / 2 pV 2 S cosy’ 


For extreme bank angles the following relationship can be derived: 



'max 


(28) 
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Therefore, it can be stated that: 

±0 max = imin \ arccos ( , — ,35° (29) 

1 \C Ln J/ 2 pV^Scos 7 J f 

where C/, Itlax = C/ (l + C/ n Q! max . In this calculation the current values for airspeed V 
and flight path angle y are used, the up-to-date values for C/„ and C/ a as provided 
by the identification algorithm, as well as the maximum angle of attack « max • For 
normal maneuvers of a conventional civil airliner, the maximum bank angle is not 
expected to exceed 35°. 

Reducing speed will restrict the available bank range to lower values of ±0 max . 
At stall speed, no bank authority will be left. Some typical values for the nominal 
RCAM model are given in Table 2. 


Table 2 Some typical values of maximum bank angle at different airspeeds for the RCAM model 


V [m/s] 

«[°] 

0max[°] 

75 

3 

±60 

59 

9 

±35 

53 

14.5 



3 Additional information provided to the pilot over the cockpit 
displays 

The information obtained from the envelope estimation algorithm can then be pre- 
sented to the pilot. This is done in the primary flight display (PFD). The speed and 
flight path angle boundaries, which apply for the current bank angle and sideslip 
angle, are shown on the relevant parts of the PFD. Also the bank angle limits are 
displayed on the PFD. 

The calculated true airspeed boundaries (TAS) are converted to indicated air- 
speed (IAS) by taking into account altitude varying air density and presented on the 
speedtape at the left hand side of the artificial horizon in the PFD. The flight path 
angle information yis translated into vertical speed h and presented on the vertical 
speed tape at the right hand side of the artificial horizon in the PFD. 

Safe envelope information presented on the vertical speed tape, as illustrated in 
Fig. 7, is absent in current PFDs. In this new setup, the amber lines mark the vertical 
speed ranges where no equilibrium can be established. In practice, this means that 
speed will increase in the lower amber region, even for idle thrust, and that speed 
will decrease in the upper amber region, even with full thrust. The red barber poles 
mark the ranges where the maneuverability envelope is left. In practice, this means 
that it is impossible to reach this range and return to trim within 5 s for each direc- 
tion. For the bank angle limits, the amber region is static on the 35° marker. The red 
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barber regions indicate where stall will occur and are determined by the maximum 
bank angle as calculated in Sec. 2.4. 



Fig. 7 The envelope limits as displayed on the primary flight display, and how they are driven by 
the envelope calculation 


4 Application examples 

Two main application examples have been considered in this research, both scenar- 
ios have an impact on the speed boundaries of the safe flight envelope. The first one 
is a generic simplified icing scenario, the latter is an unscheduled stabilizer deflec- 
tion. The nature of both scenarios is elaborated in detail, after which the calculated 
effects on the envelope are analysed. Finally the observations are verified from a 
flight dynamics point of view. 


4.1 Icing scenario 

In specific atmospheric conditions, ice accretion is possible on the aircraft wings. 
In this example, it is assumed that the regular thermal anti-ice systems, which are 
conventional equipment on all civil airliners, are operating but are not successful in 
removing all and/or preventing any ice being built up on the wings. This example 
will focus on the impact of ice accretion on the flight performance envelope of the 
aircraft. 
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4.1.1 Impact on the simulation model 

The influence of icing can be injected into the maneuverability model through two 
primary mechanisms. First, changes in the flight dynamics are represented through 
the aerodynamic parameters. Typically, icing will decrease lift Cl and increase drag 
Cd ■ For this simplified example, all lift coefficients (C’/, () and C/ n ) have been scaled 
down by 20%, and all drag coefficients (Cd 0 , Co a and Cd 2 ) up by 20%. The second 
mechanism is modeling diminished control authority through the set 88 of overall 
allowable virtual inputs. For example, the maximum permissible angle of attack 
may diminish due to icing. In this generic example, the stall angle of attack ce max is 
reduced from 14.5° to 8°, in addition to the coefficient changes, and its impact on 
the safe flight envelope has been analysed. 


4.1.2 Effect on the safe flight envelope 

Fig. 8(a) shows that a 20% decrease in lift combined with a 20% increase in drag 
results in a shift of the trim envelope towards higher airspeeds and lower flight path 
angles. The following force equilibrium equations explain this physically: 


1 1 

C L (a) -pV 2 S = W cos y « W 

(30) 

1 0 

T~C D (a) -pV~S = W sin y « Wy 

(31) 


Due to the reduced lift capability, it can be seen in Eq. 30 that a higher airspeed is 
needed to compensate for the aircraft weight. On the other hand, an increase in drag 
means that less net excess thrust is available for climb in Eq. 31. If the maximum 
angle of attack limit a max is reduced, then there is a further reduction in maximum 
lift capability, which is translated into a shift to the right of the left limit of the trim 
envelope, as shown in Fig. 8(b). Note that a decrease in a max leads to the loss of any 
possibility to establish trim below approximately V = 70m/s. 




(a) icing effect 


(b) icing effect and reduced o^ax 


Fig. 8 Comparison of trim envelopes of the damaged and undamaged RCAM model 
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Next the V, y maneuvering envelope is calculated for bank angle (p = 0, with and 
without generic icing scenario involving 20% decrease in lift force and increase in 
drag force, and with an additional envelope degradation scenario caused by a re- 
duced maximum angle of attack. This example builds further on the results for the 
trim envelope, as presented in Fig. 8. The intersection of forwards and backwards 
reachability is defined as the safe maneuvering envelope and is shown in Fig. 9. 
The time horizon in this example is set at T = 5s. This choice is based on the time 
constants of the considered relevant dynamics. The blue rectangular contour corre- 
sponds to the rectangle with the largest area which can be drawn in the trim envelope 
of the nominal aircraft as depicted in Fig. 3. Similarly the red contours correspond 
to the rectangles with the largest area which can be spanned in the trim envelopes of 
both damage scenarios in Fig. 8(b). 


Analysis of safe set Analysis of safe set 




(a) Effect of 20% decrease in lift coefficient (b) Additional envelope degradation caused 
and 20% increase in drag coefficient by reduction of maximum angle of attack 

Fig. 9 Calculation of safe maneuvering envelope sets through forward and backward reachability 
analysis over T = 5s, based on calculated trim envelope boundaries and identified aerodynamic 
parameters. Upper left envelope areas correspond to nominal configuration. 


Comparing undamaged and damaged envelope boundaries shows the influence 
of the damage characteristics. In Fig. 9(a), it can be seen that the safe maneuvering 
envelope shift is similar as for the trim envelope. A higher speed range is needed 
to compensate for the loss in the lift force coefficient, and not as large positive 
flight path angles can be reached due to the smaller excess of net thrust due to the 
increased drag. In Fig. 9(b), it can be seen that the restriction on maximum angle 
of attack leads to a further shrinking of the maneuvering envelope, especially for 
slower speeds since stall will occur for higher airspeeds. 

Extensive Monte Carlo analyses have been performed in order to verify the accu- 
racy of the boundaries of the estimated maneuvering envelopes. These analyses have 
been based on the non-simplified aircraft model, ignoring the assumption that the 
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aerodynamic angles a and p should be small. All these Monte Carlo analyses have 
confirmed that the results provided here are accurate and that the simplifications 
hold for the current ranges of the aerodynamic angles, namely a € [0°; 14.5°] (no 
icing) and P € [—5°; +5°]. This is an important conclusion which makes a relevant 
on-line safe maneuvering envelope estimation tool much more feasible. 


4.1.3 Maximum bank angle in icing conditions 

Since the total maximum lift capability C/, inax of the aircraft characteristics will de- 
crease in an icing scenario, while the total weight W will remain unchanged, it can 
be expected that this will have a significant impact on the maximum bank angle. As 
a consequence cos @ max will increase, which corresponds to a decrease in © max . The 
effect and comparison without icing is shown in table 3. 


Table 3 Some typical values of maximum bank angle at different airspeeds for the RCAM model 
with and without icing 


V [m/s] 

84 

75 

66 

59 

53 

(Wx[°] with ice 

±60 

±50 

±35 

« 0 

0 

</>max[°] no ice 

±66 

±60 

±49 

±35 

«0 


4.2 Stabilizer misalignment 


Another scenario considered in this study, was a nose down stab trim misalignment, 
which generates a pitch up moment. The disturbing moment must then be coun- 
teracted by the elevators, which come close to their saturation limits. This results 
in significantly stricter upper envelope limits on speed and climb rate. For practi- 
cal purposes, it is important to achieve zero angular rates around all body axes, in 
order to establish a stabilized final approach. Relying on Newton’s second law for 
rotations: M„ = Ift) I ft) x Ifi), the requirement for ft) = 0 as well as ft) = 0, results 
in the requirement that the total aerodynamic moment M fl (the pitching moment M 
around the Y-axis in the specific case considered here) should be equal to zero. 

Considering Eq. (10) for this specific case: 


C in — 0 — C,n (l ± C ma a + C, 


qc 

"V 

q — 0 


S e “b Cf n it ih 


qdl 


(32) 


eng 


disturbance 


for the combination of the required pitch rate q = 0 and the disturbance ih caused 
by the misaligned stab, together with the given trim values for angle of attack a 
and thrust T calculated earlier, a specific value for elevator deflection 8 e is needed 
in order to balance the total Eq. (32), while taking into account the upper saturation 
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limit of the elevator t),, lllax . Eq. (32) is an additional trim requirement, besides Eq. (9). 
In most conventional flight conditions without stab misalignment, Eq. (32) has no 
effect on the shape of the trim envelope. However, the impact on the trim envelope 
is significant for large angle stabilizer misalignment, as can be seen in Fig. 10. 



(a) i h = 0° (b) i h = -6° (c) i h = -8° 


Fig. 10 V, y trim envelopes for different stabilizer misalignment scenarios for bank angle <p = 0 
and sideslip angle /3 = 0. Elevator saturation limits are —30° and +20°. 


Fig. 10(a) shows that the required elevator deflections for a stabilizer stuck at 
0° vary between —8° and 15° over the entire trim envelope, which is well between 
the elevator saturation limits —30° and +20°. However, Fig. 10(b) and 10(c) show 
a totally different situation for a stabilizer misalignment at 6° or 8° nose down re- 
spectively. The pitch up moment which is generated requires significant elevator 
deflection and they hit their maximum limit at 8 em . dx = 20° within the trim envelope 
calculated based on lift an drag. This additional input constraint results in the fact 
that the envelope is significantly smaller. For level flight y= 0°, the conventional 
maximum airspeed of V = 135m/s is reduced to V = lOOm/s for i/, = —8° to pre- 
vent elevator saturation. This is relevant information, which increases the crew’s 
situational awareness significantly in this type of scenario. 


5 Conclusions and recommendations 

The methods presented in this paper have three distinguishing features. First, instead 
of linearizing the full aircraft dynamics model, a representative compact nonlinear 
model has been determined. This enabled rapid numerical computations, which are 
more representative of the aircraft performance than would be obtained through lin- 
earized models. Second, the integrated modular approach involving system identifi- 
cation - trim envelope calculation - maneuvering envelope calculation leverages the 
same dynamics model to estimate the safe flight envelope from currently available 
flight data as provided by current sensor packages on-board civil airliners, while also 
establishing confidence regions biased towards greater uncertainty when insufficient 
input excitation is available. Furthermore, the system identification process makes 
the global approach adaptive for (unintentional) configuration changes and damage, 
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which has been shown in the application examples. Third, the safe maneuvering 
envelope maximizes the options pilots or automation systems have to recover the 
aircraft in damage scenarios, while remaining robust to the uncertainty in the sys- 
tem identification process. The net result is an increased flexibility for developing 
advanced aircraft diagnostics that provide the bottom line maneuverability of the 
aircraft as an output, and this is expected to have important applications to flight 
planning, trajectory generation, guidance algorithms, and pilot displays. 


6 Further research 

The display features presented here, providing up to date safe flight envelope in- 
formation to the flight crew, have been evaluated in the Advanced Concepts Flight 
Simulator at NASA Ames Research Center to investigate the impact on aircraft en- 
ergy state awareness of the crew. Commercial airline crews have flown multiple 
challenging approach and landing scenarios in a relevant environment simulating 
the airspace around Memphis International Airport. More details and extensive re- 
sults of this specific simulator study can be found in Ref. [11], 
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